Nexcess
Monthly
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.
Unauthenticated broken access control in the GiveWP WordPress donation plugin through version 4.19.0.1 lets remote attackers reach plugin operations that should require authorization, yielding limited confidentiality and integrity impact with no availability effect (CVSS 6.5). The assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials and no user interaction are needed, although the specific endpoint or parameter that lacks its capability check is not disclosed in the available sources. No CISA KEV entry and no public exploit code were identified at time of analysis, and the issue is scoped in the this_month (routine monthly patching) priority band rather than as an emergency.
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
Cross-site scripting (XSS) in the Virtue/Ascend/Pinnacle Toolkit WordPress plugin allows an authenticated Contributor-level user to inject malicious script that executes in a higher-privileged user's browser when they view the crafted content, potentially leading to session theft or unauthorized actions. The vulnerability affects versions up to and including 4.9.12.1 and requires user interaction (UI:R) combined with Contributor access (PR:L), with a CVSS 3.1 base score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can exploit an insecure direct object reference (IDOR) in the GiveWP WordPress donation plugin through versions 4.16.9 and earlier to manipulate another entity's object without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, yielding a moderate 5.3 score; impact is limited to integrity, with no confidentiality or availability effect, and exploitation depends on enumerating or predicting valid object identifiers. No public exploit identified at time of analysis, and the exact vulnerable endpoint and parameter are not disclosed in the advisory.
GiveWP versions up to and including 4.16.9 expose sensitive donor-related data to any authenticated low-privilege user, because a plugin endpoint performs no authorization check before returning the data. The issue is a broken access control flaw (CWE-862) rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by Patchstack, meaning an attacker needs only a Subscriber-level account and no user interaction, with confidentiality as the sole impacted metric. Sites that leave WordPress self-registration open are the most exposed, while sites with registration disabled and no attacker-controlled low-privilege accounts are substantially harder to exploit; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.
Unauthenticated broken access control in the GiveWP WordPress donation plugin through version 4.19.0.1 lets remote attackers reach plugin operations that should require authorization, yielding limited confidentiality and integrity impact with no availability effect (CVSS 6.5). The assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials and no user interaction are needed, although the specific endpoint or parameter that lacks its capability check is not disclosed in the available sources. No CISA KEV entry and no public exploit code were identified at time of analysis, and the issue is scoped in the this_month (routine monthly patching) priority band rather than as an emergency.
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
Cross-site scripting (XSS) in the Virtue/Ascend/Pinnacle Toolkit WordPress plugin allows an authenticated Contributor-level user to inject malicious script that executes in a higher-privileged user's browser when they view the crafted content, potentially leading to session theft or unauthorized actions. The vulnerability affects versions up to and including 4.9.12.1 and requires user interaction (UI:R) combined with Contributor access (PR:L), with a CVSS 3.1 base score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can exploit an insecure direct object reference (IDOR) in the GiveWP WordPress donation plugin through versions 4.16.9 and earlier to manipulate another entity's object without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, yielding a moderate 5.3 score; impact is limited to integrity, with no confidentiality or availability effect, and exploitation depends on enumerating or predicting valid object identifiers. No public exploit identified at time of analysis, and the exact vulnerable endpoint and parameter are not disclosed in the advisory.
GiveWP versions up to and including 4.16.9 expose sensitive donor-related data to any authenticated low-privilege user, because a plugin endpoint performs no authorization check before returning the data. The issue is a broken access control flaw (CWE-862) rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by Patchstack, meaning an attacker needs only a Subscriber-level account and no user interaction, with confidentiality as the sole impacted metric. Sites that leave WordPress self-registration open are the most exposed, while sites with registration disabled and no attacker-controlled low-privilege accounts are substantially harder to exploit; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.